<!DOCTYPE HTML>
<html lang="zh-CN">


<head>
    <meta charset="utf-8">
    <meta name="keywords" content="Linux Capability setuid 权能 ping">
    <meta name="description" content="Go go">
    <meta http-equiv="X-UA-Compatible" content="IE=edge">
    <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=no">
    <meta name="renderer" content="webkit|ie-stand|ie-comp">
    <meta name="mobile-web-app-capable" content="yes">
    <meta name="format-detection" content="telephone=no">
    <meta name="apple-mobile-web-app-capable" content="yes">
    <meta name="apple-mobile-web-app-status-bar-style" content="black-translucent">
    <!-- Global site tag (gtag.js) - Google Analytics -->


    <title>Linux 权能机制 | Xsyin</title>
    <link rel="icon" type="image/png" href="/favicon.png">

    <link rel="stylesheet" type="text/css" href="/libs/awesome/css/all.css">
    <link rel="stylesheet" type="text/css" href="/libs/materialize/materialize.min.css">
    <link rel="stylesheet" type="text/css" href="/libs/aos/aos.css">
    <link rel="stylesheet" type="text/css" href="/libs/animate/animate.min.css">
    <link rel="stylesheet" type="text/css" href="/libs/lightGallery/css/lightgallery.min.css">
    <link rel="stylesheet" type="text/css" href="/css/matery.css">
    <link rel="stylesheet" type="text/css" href="/css/my.css">

    <script src="/libs/jquery/jquery.min.js"></script>

<meta name="generator" content="Hexo 6.3.0"></head>




<body>
    <header class="navbar-fixed">
    <nav id="headNav" class="bg-color nav-transparent">
        <div id="navContainer" class="nav-wrapper container">
            <div class="brand-logo">
                <a href="/" class="waves-effect waves-light">
                    
                    <img src="/medias/logo.png" class="logo-img" alt="LOGO">
                    
                    <span class="logo-span">Xsyin</span>
                </a>
            </div>
            

<a href="#" data-target="mobile-nav" class="sidenav-trigger button-collapse"><i class="fas fa-bars"></i></a>
<ul class="right nav-menu">
  
  <li class="hide-on-med-and-down nav-item">
    
    <a href="/" class="waves-effect waves-light">
      
      <i class="fas fa-home" style="zoom: 0.6;"></i>
      
      <span>首页</span>
    </a>
    
  </li>
  
  <li class="hide-on-med-and-down nav-item">
    
    <a href="/tags" class="waves-effect waves-light">
      
      <i class="fas fa-tags" style="zoom: 0.6;"></i>
      
      <span>标签</span>
    </a>
    
  </li>
  
  <li class="hide-on-med-and-down nav-item">
    
    <a href="/categories" class="waves-effect waves-light">
      
      <i class="fas fa-bookmark" style="zoom: 0.6;"></i>
      
      <span>分类</span>
    </a>
    
  </li>
  
  <li class="hide-on-med-and-down nav-item">
    
    <a href="/archives" class="waves-effect waves-light">
      
      <i class="fas fa-archive" style="zoom: 0.6;"></i>
      
      <span>归档</span>
    </a>
    
  </li>
  
  <li class="hide-on-med-and-down nav-item">
    
    <a href="/about" class="waves-effect waves-light">
      
      <i class="fas fa-user-circle" style="zoom: 0.6;"></i>
      
      <span>关于</span>
    </a>
    
  </li>
  
  <li class="hide-on-med-and-down nav-item">
    
    <a href="/contact" class="waves-effect waves-light">
      
      <i class="fas fa-comments" style="zoom: 0.6;"></i>
      
      <span>留言板</span>
    </a>
    
  </li>
  
  <li class="hide-on-med-and-down nav-item">
    
    <a href="/friends" class="waves-effect waves-light">
      
      <i class="fas fa-address-book" style="zoom: 0.6;"></i>
      
      <span>友情链接</span>
    </a>
    
  </li>
  
  <li>
    <a href="#searchModal" class="modal-trigger waves-effect waves-light">
      <i id="searchIcon" class="fas fa-search" title="搜索" style="zoom: 0.85;"></i>
    </a>
  </li>
</ul>


<div id="mobile-nav" class="side-nav sidenav">

    <div class="mobile-head bg-color">
        
        <img src="/medias/logo.png" class="logo-img circle responsive-img">
        
        <div class="logo-name">Xsyin</div>
        <div class="logo-desc">
            
            Go go
            
        </div>
    </div>

    

    <ul class="menu-list mobile-menu-list">
        
        <li class="m-nav-item">
	  
		<a href="/" class="waves-effect waves-light">
			
			    <i class="fa-fw fas fa-home"></i>
			
			首页
		</a>
          
        </li>
        
        <li class="m-nav-item">
	  
		<a href="/tags" class="waves-effect waves-light">
			
			    <i class="fa-fw fas fa-tags"></i>
			
			标签
		</a>
          
        </li>
        
        <li class="m-nav-item">
	  
		<a href="/categories" class="waves-effect waves-light">
			
			    <i class="fa-fw fas fa-bookmark"></i>
			
			分类
		</a>
          
        </li>
        
        <li class="m-nav-item">
	  
		<a href="/archives" class="waves-effect waves-light">
			
			    <i class="fa-fw fas fa-archive"></i>
			
			归档
		</a>
          
        </li>
        
        <li class="m-nav-item">
	  
		<a href="/about" class="waves-effect waves-light">
			
			    <i class="fa-fw fas fa-user-circle"></i>
			
			关于
		</a>
          
        </li>
        
        <li class="m-nav-item">
	  
		<a href="/contact" class="waves-effect waves-light">
			
			    <i class="fa-fw fas fa-comments"></i>
			
			留言板
		</a>
          
        </li>
        
        <li class="m-nav-item">
	  
		<a href="/friends" class="waves-effect waves-light">
			
			    <i class="fa-fw fas fa-address-book"></i>
			
			友情链接
		</a>
          
        </li>
        
        
        <li><div class="divider"></div></li>
        <li>
            <a href="https://github.com/blinkfox/hexo-theme-matery" class="waves-effect waves-light" target="_blank">
                <i class="fab fa-github-square fa-fw"></i>Fork Me
            </a>
        </li>
        
    </ul>
</div>


        </div>

        
            <style>
    .nav-transparent .github-corner {
        display: none !important;
    }

    .github-corner {
        position: absolute;
        z-index: 10;
        top: 0;
        right: 0;
        border: 0;
        transform: scale(1.1);
    }

    .github-corner svg {
        color: #0f9d58;
        fill: #fff;
        height: 64px;
        width: 64px;
    }

    .github-corner:hover .octo-arm {
        animation: a 0.56s ease-in-out;
    }

    .github-corner .octo-arm {
        animation: none;
    }

    @keyframes a {
        0%,
        to {
            transform: rotate(0);
        }
        20%,
        60% {
            transform: rotate(-25deg);
        }
        40%,
        80% {
            transform: rotate(10deg);
        }
    }
</style>

<a href="https://github.com/blinkfox/hexo-theme-matery" class="github-corner tooltipped hide-on-med-and-down" target="_blank"
   data-tooltip="Fork Me" data-position="left" data-delay="50">
    <svg viewBox="0 0 250 250" aria-hidden="true">
        <path d="M0,0 L115,115 L130,115 L142,142 L250,250 L250,0 Z"></path>
        <path d="M128.3,109.0 C113.8,99.7 119.0,89.6 119.0,89.6 C122.0,82.7 120.5,78.6 120.5,78.6 C119.2,72.0 123.4,76.3 123.4,76.3 C127.3,80.9 125.5,87.3 125.5,87.3 C122.9,97.6 130.6,101.9 134.4,103.2"
              fill="currentColor" style="transform-origin: 130px 106px;" class="octo-arm"></path>
        <path d="M115.0,115.0 C114.9,115.1 118.7,116.5 119.8,115.4 L133.7,101.6 C136.9,99.2 139.9,98.4 142.2,98.6 C133.8,88.0 127.5,74.4 143.8,58.0 C148.5,53.4 154.0,51.2 159.7,51.0 C160.3,49.4 163.2,43.6 171.4,40.1 C171.4,40.1 176.1,42.5 178.8,56.2 C183.1,58.6 187.2,61.8 190.9,65.4 C194.5,69.0 197.7,73.2 200.1,77.6 C213.8,80.2 216.3,84.9 216.3,84.9 C212.7,93.1 206.9,96.0 205.4,96.6 C205.1,102.4 203.0,107.8 198.3,112.5 C181.9,128.9 168.3,122.5 157.7,114.1 C157.9,116.9 156.7,120.9 152.7,124.9 L141.0,136.5 C139.8,137.7 141.6,141.9 141.8,141.8 Z"
              fill="currentColor" class="octo-body"></path>
    </svg>
</a>
        
    </nav>

</header>

    



<div class="bg-cover pd-header post-cover" style="background-image: url('/medias/featureimages/18.jpg')">
    <div class="container" style="right: 0px;left: 0px;">
        <div class="row">
            <div class="col s12 m12 l12">
                <div class="brand">
                    <h1 class="description center-align post-title">Linux 权能机制</h1>
                </div>
            </div>
        </div>
    </div>
</div>




<main class="post-container content">

    
    <link rel="stylesheet" href="/libs/tocbot/tocbot.css">
<style>
    #articleContent h1::before,
    #articleContent h2::before,
    #articleContent h3::before,
    #articleContent h4::before,
    #articleContent h5::before,
    #articleContent h6::before {
        display: block;
        content: " ";
        height: 100px;
        margin-top: -100px;
        visibility: hidden;
    }

    #articleContent :focus {
        outline: none;
    }

    .toc-fixed {
        position: fixed;
        top: 64px;
    }

    .toc-widget {
        width: 345px;
        padding-left: 20px;
    }

    .toc-widget .toc-title {
        padding: 35px 0 15px 17px;
        font-size: 1.5rem;
        font-weight: bold;
        line-height: 1.5rem;
    }

    .toc-widget ol {
        padding: 0;
        list-style: none;
    }

    #toc-content {
        padding-bottom: 30px;
        overflow: auto;
    }

    #toc-content ol {
        padding-left: 10px;
    }

    #toc-content ol li {
        padding-left: 10px;
    }

    #toc-content .toc-link:hover {
        color: #42b983;
        font-weight: 700;
        text-decoration: underline;
    }

    #toc-content .toc-link::before {
        background-color: transparent;
        max-height: 25px;

        position: absolute;
        right: 23.5vw;
        display: block;
    }

    #toc-content .is-active-link {
        color: #42b983;
    }

    #floating-toc-btn {
        position: fixed;
        right: 15px;
        bottom: 76px;
        padding-top: 15px;
        margin-bottom: 0;
        z-index: 998;
    }

    #floating-toc-btn .btn-floating {
        width: 48px;
        height: 48px;
    }

    #floating-toc-btn .btn-floating i {
        line-height: 48px;
        font-size: 1.4rem;
    }
</style>
<div class="row">
    <div id="main-content" class="col s12 m12 l9">
        <!-- 文章内容详情 -->
<div id="artDetail">
    <div class="card">
        <div class="card-content article-info">
            <div class="row tag-cate">
                <div class="col s7">
                    
                    <div class="article-tag">
                        
                            <a href="/tags/Linux/">
                                <span class="chip bg-color">Linux</span>
                            </a>
                        
                            <a href="/tags/capability/">
                                <span class="chip bg-color">capability</span>
                            </a>
                        
                    </div>
                    
                </div>
                <div class="col s5 right-align">
                    
                    <div class="post-cate">
                        <i class="fas fa-bookmark fa-fw icon-category"></i>
                        
                            <a href="/categories/Linux/" class="post-category">
                                Linux
                            </a>
                        
                    </div>
                    
                </div>
            </div>

            <div class="post-info">
                
                <div class="post-date info-break-policy">
                    <i class="far fa-calendar-minus fa-fw"></i>发布日期:&nbsp;&nbsp;
                    2018-05-01
                </div>
                

                

                

                

                
            </div>
        </div>
        <hr class="clearfix">

        

        

        <div class="card-content article-card-content">
            <div id="articleContent">
                <ol>
<li><p><code>passwd​</code> ，  <code>sudo​</code> ， <code>ping​</code>  等命令会修改关键文件，确保非<code>root​</code> 用户无法修改，因此需要转换为<code>root​</code> 用户，而<code>setuid​</code> 位可以让用户暂时获得文件拥有者<code>root​</code> 的身份。</p>
<p>以<code>ping</code> 命令为例，删除<code>s</code> 位后无法<code>ping</code> ，因为没有打开<code>socket</code> 的权限。而当将<code>s</code> 位重新设置时，又可以<code>ping</code>  ：</p>
<span id="more"></span>

<p><img src="/setuid-ping.png" alt="选区_047"></p>
<p>为了执行权限检查，传统的 UNIX 实现区分两种类型的进程：特权进程（其有效用户 ID 为0，称为超级用户或 root），和非特权用户（其有效 UID 非0）。特权进程绕过所有的内核权限检查，而非特权进程受基于进程的认证信息（通常是：有效 UID，有效 GID，和补充组列表）的完整权限检查的支配。</p>
<p>自内核 2.2 版本开始，Linux 将传统上与超级用户关联的特权分为几个单元，称为 capabilities （权能），它们可以被独立的启用或禁用。权能是每个线程的属性。权能相当于规范了你这个程序所拥有的权限。相当于特权的需求的细化。当执行特权操作的时候，可以查看是否有相应的权能。</p>
<p><code>ping</code> 命令需要<code>CAP_NET_RAW</code>的权能，使用<code>setcap</code>为其添加权能：</p>
<p><img src="/%E9%80%89%E5%8C%BA_051.png" alt="选区_050"></p>
<p>可以<code>ping</code> ，且没有设置<code>uid</code> 位。</p>
</li>
<li><p>使用<code>man capabilities</code>  可以查看权能列表及相应的解释：</p>
</li>
</ol>
<ul>
<li><p><strong>CAP_AUDIT_CONTROL</strong>（自 Linux 2.6.11）<br>启用和禁用内核审计；修改审计过滤器规则；提取审计状态和过滤规则。</p>
</li>
<li><p><strong>CAP_AUDIT_READ</strong>（自 Linux 3.16）<br>允许通过一个多播 netlink socket 读取审计日志。</p>
</li>
<li><p><strong>CAP_AUDIT_WRITE</strong>（自 Linux 2.6.11）<br>向内核审计日志写记录。</p>
</li>
<li><p><strong>CAP_BLOCK_SUSPEND</strong>（自 Linux 3.5）<br>可以阻塞系统挂起（<strong>epoll</strong>(7) <strong>EPOLLWAKEUP</strong>，*&#x2F;proc&#x2F;sys&#x2F;wake_lock*）的特性。</p>
</li>
<li><p><strong>CAP_CHOWN</strong><br>对文件的 UIDs 和 GIDs 做任意的修改（参考 <strong>chown</strong>(2)）。</p>
</li>
<li><p><strong>CAP_DAC_OVERRIDE</strong><br>绕过文件的读，写，和执行权限检查。（DAC 是 “discretionary access control” 的缩写。）</p>
</li>
<li><p>CAP_DAC_READ_SEARCH</p>
<ul>
<li>绕过文件的读权限检查和目录的读和执行权限检查；</li>
<li>调用 <strong>open_by_handle_at</strong>(2)。</li>
</ul>
</li>
<li><p>CAP_FOWNER</p>
<ul>
<li>对于通常要求进程的文件系统 UID 与文件的 UID 匹配的操作，绕过权限检查 (比如，<strong>chmod</strong>(2)，<strong>utime</strong>(2))，除了那些包含在 <strong>CAP_DAC_OVERRIDE</strong> 和 <strong>CAP_DAC_READ_SEARCH</strong> 中的操作；</li>
<li>为任意文件设置扩展文件属性(参考 <strong>chattr</strong>(1))；</li>
<li>为任意文件设置访问控制表(ACLs)；</li>
<li>对文件删除操作忽略目录的 sticky 位；</li>
<li>在 <strong>open</strong>(2) 和 <strong>fcntl</strong>(2) 任意文件时设置 <strong>O_NOATIME</strong>。</li>
</ul>
</li>
<li><p><strong>CAP_FSETID</strong><br>当文件修改时不清除 set-user-ID 和 set-group-ID 模式位；为文件 GID 与调用进程的文件系统或补充 GIDs 不匹配的文件设置 set-group-ID 位。</p>
</li>
<li><p><strong>CAP_IPC_LOCK</strong><br>锁定内存 (<strong>mlock</strong>(2)，<strong>mlockall</strong>(2)，<strong>mmap</strong>(2)，<strong>shmctl</strong>(2))。</p>
</li>
<li><p><strong>CAP_IPC_OWNER</strong><br>绕过对 System V IPC 对象的操作的权限检查。</p>
</li>
<li><p><strong>CAP_KILL</strong><br>绕过发送信号 (参考 <strong>kill</strong>(2)) 时的权限检查。这包括使用 <strong>ioctl</strong>(2) <strong>KDSIGACCEPT</strong> 操作。</p>
</li>
<li><p><strong>CAP_LEASE</strong>（自 Linux 2.4）<br>为任意文件建立租约 (参考 <strong>fcntl</strong>(2))。</p>
</li>
<li><p><strong>CAP_LINUX_IMMUTABLE</strong><br>设置<strong>FS_APPEND_FL</strong> 和 <strong>FS_IMMUTABLE_FL</strong> inode 标记 (参考 <strong>chattr</strong>(1))。</p>
</li>
<li><p><strong>CAP_MAC_ADMIN</strong>（自 Linux 2.6.25）<br>覆盖强制访问控制 (Mandatory Access Control (MAC)). 为 Smack Linux 安全模块(Linux Security Module (LSM)) 而实现。</p>
</li>
<li><p><strong>CAP_MAC_OVERRIDE</strong>（自 Linux 2.6.25）<br>允许 MAC 配置或状态改变。为 Smack LSM 而实现。</p>
</li>
<li><p><strong>CAP_MKNOD</strong>（自 Linux 2.4）<br>使用 <strong>mknod</strong>(2) 创建特殊文件。</p>
</li>
<li><p>CAP_NET_ADMIN</p>
<p>执行多种网络有关的操作：</p>
<ul>
<li>接口配置；</li>
<li>IP 防火墙，地址伪装，和账单管理；</li>
<li>修改路由表；</li>
<li>为透明代理绑定任何地址；</li>
<li>设置服务类性 (type-of-service (TOS))；</li>
<li>清理驱动统计资料；</li>
<li>设置混杂模式；</li>
<li>启用组播；</li>
<li>使用 <strong>setsockopt</strong>(2) 设置下列 socket 选项：<strong>SO_DEBUG</strong>，<strong>SO_MARK</strong>，<strong>SO_PRIORITY</strong> (在0到6范围之外的优先级)，<strong>SO_RCVBUFFORCE</strong>，和 <strong>SO_SNDBUFFORCE</strong>。</li>
</ul>
</li>
<li><p><strong>CAP_NET_BIND_SERVICE</strong><br>将一个 socket 绑定到一个互联网域特权端口 (端口号小于 1024)。</p>
</li>
<li><p><strong>CAP_NET_BROADCAST</strong><br>(未使用) 使 socket 发送组播，并监听组播。</p>
</li>
<li><p>CAP_NET_RAW</p>
<ul>
<li>使用 RAW 和 PACKET sockets；</li>
<li>为透明代理绑定任何地址。</li>
</ul>
</li>
<li><p><strong>CAP_SETGID</strong><br>执行任意的进程 GIDs 和补充 GID 列表管理；当通过 UNIX 域 sockets 传递 socket 认证信息时伪造 GID；在一个用户命名空间 (参考 <strong>user_namespaces</strong>(7)) 中写入组 ID 映射。</p>
</li>
<li><p>CAP_SETFCAP (since Linux 2.6.24)<br>设置文件的权能。</p>
</li>
<li><p>CAP_SETPCAP</p>
<p>如果文件权能不受支持：授予或删除调用者功能设置位或来自任何其他进程的任何权能。 （当内核配置为支持文件功能时，CAP_SETPCAP的此属性不可用，因为CAP_SETPCAP对于这样的内核具有完全不同的语义。）</p>
<p>如果支持文件权能：从调用线程的边界集中添加任意权能到其可继承位;从边界集中删除权能（通过prctl（2）PR_CAPBSET_DROP）;<br>      对securebits标志进行更改。</p>
</li>
<li><p>CAP_SETUID</p>
</li>
<li><p>CAP_SYS_ADMIN</p>
<ul>
<li>执行一系列系统管理操作，包括：<strong>quotactl</strong>(2)，<strong>mount</strong>(2)，<strong>umount</strong>(2)，<strong>swapon</strong>(2)，<strong>swapoff</strong>(2)，<strong>sethostname</strong>(2)，和 <strong>setdomainname</strong>(2)；</li>
<li>执行特权 syslog(2) 操作 (自 Linux 2.6.37 开始，应该使用 CAP_SYSLOG 来允许这一操作)；</li>
<li>执行 <strong>VM86_REQUEST_IRQ vm86</strong>(2) 命令；</li>
<li>对任意 System V IPC 对象执行 IPC_SET 和 IPC_RMID 操作；</li>
<li>覆盖 RLIMIT_NPROC 资源限制；</li>
<li>执行 trusted 和 security Extended Attributes (see <strong>xattr</strong>(7)) 操作；</li>
<li>使用 <strong>lookup_dcookie</strong>(2)；</li>
<li>使用 ioprio_set(2) 来分配 IOPRIO_CLASS_RT 和 (Linux 2.6.25 之前) IOPRIO_CLASS_IDLE I&#x2F;O 调度类别；</li>
<li>当通过 UNIX 域 sockets 传递 socket 认证信息时伪装 PID；</li>
<li>在系统调用打开文件 (比如，<strong>accept</strong>(2)，<strong>execve</strong>(2)，<strong>open</strong>(2)，<strong>pipe</strong>(2)) 时，超出 &#x2F;proc&#x2F;sys&#x2F;fs&#x2F;file-max，系统范围内打开文件数的限制；</li>
<li>通过 <strong>clone</strong>(2) 和 <strong>unshare</strong>(2) 使用 <strong>CLONE_*</strong> 标记创建新的命名空间（但是，自从 Linux 3.8 开始，创建命名空间不需要任何权能）；</li>
<li>调用 <strong>perf_event_open</strong>(2)；</li>
<li>访问特权 perf 事件信息；</li>
<li>调用 <strong>setns</strong>(2) (在目标命名空间中需要 CAP_SYS_ADMIN)；</li>
<li>调用 <strong>fanotify_init</strong>(2)；</li>
<li>调用 <strong>bpf</strong>(2)；</li>
<li>执行 <strong>KEYCTL_CHOWN</strong> 和 <strong>KEYCTL_SETPERM keyctl</strong>(2) 操作；</li>
<li>执行 <strong>madvise</strong>(2) <strong>MADV_HWPOISON</strong> 操作；</li>
<li>使用 <strong>TIOCSTI ioctl</strong>(2) 向一个终端的输入队列中插入字符，而不是调用者的控制终端；</li>
<li>使用废弃的 <strong>nfsservctl</strong> (2) 系统调用；</li>
<li>使用废弃的 <strong>bdflush</strong> (2) 系统调用；</li>
<li>执行各种特权的块设备 <strong>ioctl</strong>(2) 操作；</li>
<li>执行各种特权的文件系统 <strong>ioctl</strong>(2) 操作；</li>
<li>对许多设备驱动执行管理操作。</li>
</ul>
</li>
<li><p><strong>CAP_SYS_BOOT</strong><br>使用 <strong>reboot</strong>(2) 和 <strong>kexec_load</strong>(2)。</p>
</li>
<li><p><strong>CAP_SYS_CHROOT</strong><br>使用 <strong>chroot</strong>(2)。</p>
</li>
<li><p><strong>CAP_SYS_MODULE</strong><br>加载和卸载内核模块(参考 <strong>init_module</strong>(2) 和 <strong>delete_module</strong>(2))；在 2.6.25 之前的内核中：从系统范围内的权能边界集合中丢弃权能。</p>
</li>
<li><p>CAP_SYS_NICE</p>
<ul>
<li>触发进程 nice 值 (<strong>nice</strong>(2)，<strong>setpriority</strong>(2)) 和为任意进程改变 nice 值；</li>
<li>为调用进程设置实时调度策略，及为任意进程设置调度策略和优先级 (<strong>sched_setscheduler</strong>(2)，<strong>sched_setparam</strong>(2)，<strong>shed_setattr</strong>(2))；</li>
<li>为任意进程设置 CPU affinity (<strong>sched_setaffinity</strong>(2))；</li>
<li>为任意进程设置 I&#x2F;O 调度类别和优先级 (<strong>ioprio_set</strong>(2))；</li>
<li>对任意进程应用 <strong>migrate_pages</strong>(2) 并允许进程被迁移到任意节点；</li>
<li>对任意进程应用 <strong>move_pages</strong>(2)；</li>
<li>在 <strong>mbind</strong>(2) 和 <strong>move_pages</strong>(2) 中使用 <strong>MPOL_MF_MOVE_ALL</strong> 标记。</li>
</ul>
</li>
<li><p><strong>CAP_SYS_PACCT</strong><br>使用 <strong>acct</strong>(2)。</p>
</li>
<li><p>CAP_SYS_PTRACE</p>
<ul>
<li>使用 <strong>ptrace</strong>(2) 追踪任意进程；</li>
<li>对任意进程应用 <strong>get_robust_list</strong>(2)；</li>
<li>使用 <strong>process_vm_readv</strong>(2) 和 <strong>process_vm_writev</strong>(2) 同任意进程的内存传输数据；</li>
<li>使用 <strong>kcmp</strong>(2) 检查进程。</li>
</ul>
</li>
<li><p>CAP_SYS_RAWIO</p>
<ul>
<li>执行 I&#x2F;O 端口操作 (<strong>iopl</strong>(2) 和 <strong>ioperm</strong>(2))；</li>
<li>访问 &#x2F;proc&#x2F;kcore；</li>
<li>使用 <strong>FIBMAP ioctl</strong>(2) 操作；</li>
<li>打开设备访问 x86 模式特有寄存器 (MSRs，参考 <strong>msr</strong>(4))；</li>
<li>更新 &#x2F;proc&#x2F;sys&#x2F;vm&#x2F;mmap_min_addr；</li>
<li>在地址低于 &#x2F;proc&#x2F;sys&#x2F;vm&#x2F;mmap_min_addr 的位置创建内存映射；</li>
<li>在 &#x2F;proc&#x2F;bus&#x2F;pci 中映射文件；</li>
<li>打开 &#x2F;dev&#x2F;mem 和 &#x2F;dev&#x2F;kmem；</li>
<li>执行各种 SCSI 设备命令；</li>
<li>在 <strong>hpsa</strong>(4) 和 <strong>cciss</strong>(4) 设备上执行某一操作；</li>
<li>在其它设备上执行一系列设备特有操作。</li>
</ul>
</li>
<li><p>CAP_SYS_RESOURCE</p>
<ul>
<li>使用 ext2 文件系统上的预留空间；</li>
<li>执行 ioctl(2) 调用控制 ext3 日志；</li>
<li>覆盖磁盘配额限制；</li>
<li>增加资源限制 (参考 <strong>setrlimit</strong>(2))；</li>
<li>覆盖 RLIMIT_NPROC 资源限制；</li>
<li>在终端分配上覆盖最大的终端数；</li>
<li>覆盖最大的 keymaps 个数；</li>
<li>允许实时时钟中断大于64 hz；</li>
<li>触发一个 System V 消息队列的 msg_qbytes 限制超过 &#x2F;proc&#x2F;sys&#x2F;kernel&#x2F;msgmnb 中的限制 (参考 <strong>msgop</strong>(2) 和 <strong>msgctl</strong>(2))；</li>
<li>当使用 <strong>F_SETPIPE_SZ fcntl</strong>(2) 命令设置一个管道的容量时覆盖 &#x2F;proc&#x2F;sys&#x2F;fs&#x2F;pipe-size-max 的限制；</li>
<li>使用 <strong>F_SETPIPE_SZ</strong> 增加管道的容量超出 &#x2F;proc&#x2F;sys&#x2F;fs&#x2F;pipe-max-size 指定的限制；</li>
<li>当创建 POSIX 消息队列 (参考 <strong>mq_overview</strong>(7)) 时覆盖 &#x2F;proc&#x2F;sys&#x2F;fs&#x2F;mqueue&#x2F;queues_max 的限制；</li>
<li>使用 <strong>prctl</strong>(2) <strong>PR_SET_MM</strong> 操作；</li>
<li>设置 &#x2F;proc&#x2F;PID&#x2F;oom_score_adj 为一个小于由一个具有 CAP_SYS_RESOURCE 的进程最近设置的值的值。</li>
</ul>
</li>
<li><p><strong>CAP_SYS_TIME</strong><br>设置系统时钟 (<strong>settimeofday</strong>(2)，<strong>stime</strong>(2)，<strong>adjtimex</strong>(2))；设置实时 (硬件) 时钟。</p>
</li>
<li><p><strong>CAP_SYS_TTY_CONFIG</strong><br>使用 <strong>vhangup</strong>(2)；对虚拟终端使用各种特权 <strong>ioctl</strong>(2) 操作。</p>
</li>
<li><p>CAP_SYSLOG</p>
<p>(自 Linux 2.6.37)</p>
<ul>
<li>执行特权 <strong>syslog</strong>(2) 操作。参考 <strong>syslog</strong>(2) 来获取哪些操作需要特权的信息；</li>
<li>当 &#x2F;proc&#x2F;sys&#x2F;kernel&#x2F;kptr_restrict 值为 1 时，查看通过 &#x2F;proc 和其它接口暴露<br>的内核地址。(参考 <strong>proc</strong>(5) 中 kptr_restrict 的讨论。)</li>
</ul>
</li>
<li><p><strong>CAP_WAKE_ALARM</strong> (自 Linux 3.0)<br>触发将唤醒系统的东西 (设置 CLOCK_REALTIME_ALARM 和 CLOCK_BOOTTIME_ALARM 定时器)</p>
</li>
</ul>
<ol>
<li>找出所有设置<code>uid</code> 位程序，使用以下命令：</li>
</ol>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">find / -perm /u=s</span><br><span class="line">find / -perm -4000</span><br></pre></td></tr></table></figure>

<p>结果如下：</p>
<p><img src="/%E9%80%89%E5%8C%BA_048.png" alt="选区_048"></p>
<p><img src="/%E9%80%89%E5%8C%BA_049.png" alt="选区_049"></p>
<p>部分需要的权能如下：</p>
<table>
<thead>
<tr>
<th>程序</th>
<th>需要的权能</th>
</tr>
</thead>
<tbody><tr>
<td>&#x2F;bin&#x2F;ping</td>
<td>CAP_NET_RAW</td>
</tr>
<tr>
<td>&#x2F;bin&#x2F;mount</td>
<td>CAP_SYS_ADMIN</td>
</tr>
<tr>
<td>&#x2F;bin&#x2F;su</td>
<td>CAP_DAC_OVERRIDE,CAP_SETGID,CAP_SETUID</td>
</tr>
<tr>
<td>&#x2F;bin&#x2F;fusermount</td>
<td>CAP_SYS_ADMIN</td>
</tr>
<tr>
<td>&#x2F;bin&#x2F;umount</td>
<td>CAP_SYS_ADMIN</td>
</tr>
<tr>
<td>&#x2F;usr&#x2F;bin&#x2F;passwd</td>
<td>CAP_CHOWN ,CAP_DAC_OVERRIDE ,CAP_FOWNER</td>
</tr>
</tbody></table>
<ol>
<li><p>在linux中，文件权能有如下三种：</p>
<ul>
<li>effective：当前有效的权能，执行某特权操作时，操作系统检查cap_effective的对应位是否有效,而不再是检查进程的有效UID是否为0。</li>
<li>permitted：当前进程所有能使用的能力，effective包含于permitted</li>
<li>inheritable：可以被继承的能力</li>
</ul>
<p>linux程序调用子程序，权能变换公式如下：</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line">P’(ambient) = (file <span class="keyword">is</span> privileged) ? <span class="number">0</span> : P(ambient)</span><br><span class="line">P<span class="string">&#x27;(permitted) = (P(inheritable) &amp; F(inheritable)) | (F(permitted) &amp; cap_bset)| P’(ambient)</span></span><br><span class="line"><span class="string">P&#x27;</span>(effective) = F(effective) ? P<span class="string">&#x27;(permitted) : P’(ambient)</span></span><br><span class="line"><span class="string">P&#x27;</span>(inheritable) = P(inheritable) [i.e., unchanged]</span><br></pre></td></tr></table></figure>

<p>其中：</p>
<ul>
<li>P denotes the value of a thread capability set before the execve(2)</li>
<li>P’ denotes the value of a capability set after the execve(2)</li>
<li>F denotes a file capability set</li>
<li>cap_bset is the value of the capability bounding set (described below).</li>
</ul>
<p>A privileged file is one that has capabilities or has the set-user-ID or set-group-ID bit set.</p>
</li>
</ol>
<p>实现一个程序其满足以下的功能：</p>
<ul>
<li>能够永久的删除其子进程的某个权能。</li>
<li>能暂时性的删除其子进程的某个权能。</li>
<li>能让上面被暂时性删除的权能重新获得</li>
</ul>
<p>以ping为例，我们知道ping需要的权能为cap_net_raw，为了能在execve后执行ping，即execve中的ping有cap_net_raw权能，根据上面的变换规则：</p>
<ul>
<li>设置&#x2F;bin&#x2F;ping权能为cap_net_raw+ei，使得可以继承<ul>
<li>sudo setcap cap_net_raw+ei &#x2F;bin&#x2F;ping</li>
</ul>
</li>
<li>设置当前的进程的权能有cap_net_raw+i权能</li>
</ul>
<p>永久删除子进程的权能就移除effective和inheritable、permitted的，暂时性删除就移除effective和inheritable的，恢复暂时性删除的就添加进effective和inheritable。</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br><span class="line">55</span><br><span class="line">56</span><br><span class="line">57</span><br><span class="line">58</span><br><span class="line">59</span><br><span class="line">60</span><br><span class="line">61</span><br><span class="line">62</span><br><span class="line">63</span><br><span class="line">64</span><br><span class="line">65</span><br><span class="line">66</span><br><span class="line">67</span><br><span class="line">68</span><br><span class="line">69</span><br><span class="line">70</span><br><span class="line">71</span><br><span class="line">72</span><br><span class="line">73</span><br><span class="line">74</span><br><span class="line">75</span><br><span class="line">76</span><br><span class="line">77</span><br><span class="line">78</span><br><span class="line">79</span><br><span class="line">80</span><br><span class="line">81</span><br><span class="line">82</span><br><span class="line">83</span><br><span class="line">84</span><br><span class="line">85</span><br><span class="line">86</span><br><span class="line">87</span><br><span class="line">88</span><br><span class="line">89</span><br><span class="line">90</span><br><span class="line">91</span><br><span class="line">92</span><br><span class="line">93</span><br><span class="line">94</span><br><span class="line">95</span><br><span class="line">96</span><br><span class="line">97</span><br><span class="line">98</span><br><span class="line">99</span><br><span class="line">100</span><br><span class="line">101</span><br><span class="line">102</span><br><span class="line">103</span><br><span class="line">104</span><br><span class="line">105</span><br><span class="line">106</span><br><span class="line">107</span><br><span class="line">108</span><br><span class="line">109</span><br><span class="line">110</span><br><span class="line">111</span><br><span class="line">112</span><br><span class="line">113</span><br><span class="line">114</span><br><span class="line">115</span><br><span class="line">116</span><br><span class="line">117</span><br><span class="line">118</span><br><span class="line">119</span><br><span class="line">120</span><br><span class="line">121</span><br><span class="line">122</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">#<span class="keyword">include</span> <span class="string">&lt;stdio.h&gt;</span></span></span><br><span class="line"><span class="meta">#<span class="keyword">include</span> <span class="string">&lt;stdlib.h&gt;</span></span></span><br><span class="line"><span class="meta">#<span class="keyword">include</span> <span class="string">&lt;string.h&gt;</span></span></span><br><span class="line"><span class="meta">#<span class="keyword">include</span> <span class="string">&lt;sys/types.h&gt;</span></span></span><br><span class="line"><span class="meta">#<span class="keyword">include</span> <span class="string">&lt;unistd.h&gt;</span></span></span><br><span class="line"><span class="meta">#<span class="keyword">include</span> <span class="string">&lt;sys/capability.h&gt;</span></span></span><br><span class="line"><span class="meta">#<span class="keyword">include</span> <span class="string">&lt;sys/prctl.h&gt;</span></span></span><br><span class="line"><span class="meta">#<span class="keyword">undef</span> _POSIX_SOURCE</span></span><br><span class="line"></span><br><span class="line"><span class="keyword">extern</span> <span class="type">int</span> errno;</span><br><span class="line"></span><br><span class="line"><span class="type">void</span> <span class="title function_">whoami</span><span class="params">()</span> &#123;</span><br><span class="line">    <span class="built_in">printf</span>(<span class="string">&quot;uid=%i  euid=%i  gid=%i\n&quot;</span>, getuid(), geteuid(), getgid());</span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line"></span><br><span class="line"><span class="type">void</span> <span class="title function_">listCaps</span><span class="params">()</span>&#123;</span><br><span class="line">    <span class="type">cap_t</span> caps = cap_get_proc();</span><br><span class="line">    <span class="type">ssize_t</span> y = <span class="number">0</span>;</span><br><span class="line">    <span class="built_in">printf</span>(<span class="string">&quot;The Process %d was give capabilities %s\n&quot;</span>,(<span class="type">int</span>) getpid(), cap_to_text(caps, &amp;y));</span><br><span class="line">    fflush(<span class="number">0</span>);</span><br><span class="line">    cap_free(caps);</span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line"></span><br><span class="line"><span class="type">void</span> <span class="title function_">do_ping</span><span class="params">()</span>&#123;</span><br><span class="line">	<span class="keyword">if</span>(!fork())&#123;</span><br><span class="line">		whoami();</span><br><span class="line">		listCaps();</span><br><span class="line">		execlp(<span class="string">&quot;ping&quot;</span>,<span class="string">&quot;ping&quot;</span>,<span class="string">&quot;-c 1&quot;</span>,<span class="string">&quot;localhost&quot;</span>,<span class="literal">NULL</span>);</span><br><span class="line">	&#125;</span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line"></span><br><span class="line"><span class="type">void</span> <span class="title function_">init</span><span class="params">()</span>&#123;</span><br><span class="line">	<span class="keyword">if</span>(getuid() != <span class="number">0</span>)&#123;</span><br><span class="line">		<span class="built_in">puts</span>(<span class="string">&quot;请使用sudo执行本程序&quot;</span>);</span><br><span class="line">		<span class="built_in">exit</span>(<span class="number">1</span>);</span><br><span class="line">	&#125;</span><br><span class="line">		</span><br><span class="line">	<span class="type">cap_value_t</span> cap_values[] = &#123;CAP_SETUID, CAP_SETGID, CAP_SETPCAP ,CAP_NET_RAW&#125;;</span><br><span class="line"></span><br><span class="line">    <span class="type">cap_t</span> caps = cap_init();</span><br><span class="line">    cap_set_flag(caps, CAP_PERMITTED, <span class="number">4</span>, cap_values, CAP_SET);</span><br><span class="line">	cap_set_flag(caps, CAP_EFFECTIVE, <span class="number">4</span>, cap_values, CAP_SET);</span><br><span class="line">    cap_set_proc(caps);</span><br><span class="line">    prctl(PR_SET_KEEPCAPS, <span class="number">1</span>, <span class="number">0</span>, <span class="number">0</span>, <span class="number">0</span>);</span><br><span class="line">    cap_free(caps);</span><br><span class="line"></span><br><span class="line">    setgid(<span class="number">1000</span>);</span><br><span class="line">	setuid(<span class="number">1000</span>);</span><br><span class="line">	</span><br><span class="line">    caps = cap_get_proc();</span><br><span class="line">    cap_set_flag(caps, CAP_EFFECTIVE, <span class="number">4</span>, cap_values, CAP_SET);</span><br><span class="line">	cap_set_flag(caps, CAP_INHERITABLE, <span class="number">4</span>, cap_values, CAP_SET);</span><br><span class="line">    cap_set_proc(caps);</span><br><span class="line">    cap_free(caps);</span><br><span class="line">	whoami();</span><br><span class="line">	listCaps();</span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line"><span class="type">void</span> <span class="title function_">printInfo</span><span class="params">()</span>&#123;</span><br><span class="line">	<span class="built_in">puts</span>(<span class="string">&quot;\n------权能测试小程序------\n\</span></span><br><span class="line"><span class="string">请输入如下字符:\n\</span></span><br><span class="line"><span class="string">1 : 永久的删除其子进程的某个权能\n\</span></span><br><span class="line"><span class="string">2 : 暂时性的删除其子进程的某个权能\n\</span></span><br><span class="line"><span class="string">3 : 暂时性删除的权能重新获得\n\</span></span><br><span class="line"><span class="string">4 : ping -c 1 localhost\n\</span></span><br><span class="line"><span class="string">5 : 查看当前权能\n\</span></span><br><span class="line"><span class="string">q : 退出\n\</span></span><br><span class="line"><span class="string">---------------------------\n&quot;</span>);</span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line"><span class="type">int</span> <span class="title function_">main</span><span class="params">(<span class="type">int</span> argc, <span class="type">char</span> **argv)</span></span><br><span class="line">&#123;</span><br><span class="line">	init();</span><br><span class="line">	<span class="type">char</span> line[<span class="number">128</span>];</span><br><span class="line">	printInfo();</span><br><span class="line">	<span class="keyword">while</span>(fgets(line, <span class="keyword">sizeof</span>(line), <span class="built_in">stdin</span>))&#123;</span><br><span class="line">		<span class="type">char</span> cmd = line[<span class="number">0</span>];</span><br><span class="line"></span><br><span class="line">		<span class="keyword">if</span>(cmd == <span class="string">&#x27;1&#x27;</span> || cmd == <span class="string">&#x27;2&#x27;</span> || cmd == <span class="string">&#x27;3&#x27;</span>)&#123;</span><br><span class="line">			<span class="built_in">printf</span>(<span class="string">&quot;输入要操作的权能名，如cap_net_raw\n&quot;</span>);</span><br><span class="line">			fgets(line, <span class="keyword">sizeof</span>(line), <span class="built_in">stdin</span>);</span><br><span class="line">			line[<span class="built_in">strlen</span>(line) - <span class="number">1</span>] = <span class="string">&#x27;\0&#x27;</span>;</span><br><span class="line">			<span class="type">cap_value_t</span> temp;</span><br><span class="line">			<span class="keyword">if</span>(cap_from_name(line, &amp;temp) &lt; <span class="number">0</span>)&#123;</span><br><span class="line">				<span class="built_in">printf</span>(<span class="string">&quot;Error capability name\n&quot;</span>);</span><br><span class="line">			&#125;</span><br><span class="line">			<span class="keyword">else</span>&#123;</span><br><span class="line">				<span class="type">cap_t</span> caps = cap_get_proc();</span><br><span class="line"></span><br><span class="line">				<span class="keyword">if</span>(cmd == <span class="string">&#x27;3&#x27;</span>)&#123;</span><br><span class="line">					cap_set_flag(caps, CAP_EFFECTIVE, <span class="number">1</span>, &amp;temp, CAP_SET);</span><br><span class="line">					cap_set_flag(caps, CAP_INHERITABLE, <span class="number">1</span>, &amp;temp, CAP_SET);</span><br><span class="line">				&#125;</span><br><span class="line">				<span class="keyword">else</span>&#123;</span><br><span class="line">					cap_set_flag(caps, CAP_EFFECTIVE, <span class="number">1</span>, &amp;temp, CAP_CLEAR);</span><br><span class="line">					cap_set_flag(caps, CAP_INHERITABLE, <span class="number">1</span>, &amp;temp, CAP_CLEAR);</span><br><span class="line">					<span class="keyword">if</span>(cmd == <span class="string">&#x27;1&#x27;</span>)</span><br><span class="line">						cap_set_flag(caps, CAP_PERMITTED, <span class="number">1</span>, &amp;temp, CAP_CLEAR);</span><br><span class="line">				&#125;</span><br><span class="line">				<span class="keyword">if</span>(cap_set_proc(caps))</span><br><span class="line">					perror(<span class="string">&quot;cap_set_proc() ERROR: &quot;</span>);</span><br><span class="line">				<span class="keyword">else</span></span><br><span class="line">					<span class="built_in">printf</span>(<span class="string">&quot;%s %s success\n&quot;</span>, (cmd ==<span class="string">&#x27;3&#x27;</span>? <span class="string">&quot;recover&quot;</span>:<span class="string">&quot;remove&quot;</span>),line);</span><br><span class="line"></span><br><span class="line">				cap_free(caps);</span><br><span class="line">			&#125;</span><br><span class="line">		&#125;</span><br><span class="line">		<span class="keyword">else</span> <span class="keyword">if</span>(cmd == <span class="string">&#x27;4&#x27;</span>)</span><br><span class="line">			do_ping();</span><br><span class="line"> 		<span class="keyword">else</span> <span class="keyword">if</span>(cmd == <span class="string">&#x27;5&#x27;</span>)</span><br><span class="line">			listCaps();</span><br><span class="line">		<span class="keyword">else</span> <span class="keyword">if</span>(cmd == <span class="string">&#x27;q&#x27;</span>)</span><br><span class="line">			<span class="keyword">break</span>;</span><br><span class="line">       sleep(<span class="number">1</span>);  <span class="comment">//休眠1s</span></span><br><span class="line">		printInfo();</span><br><span class="line">	&#125;</span><br><span class="line">    <span class="keyword">return</span> <span class="number">0</span>;</span><br><span class="line">&#125;</span><br><span class="line"></span><br></pre></td></tr></table></figure>

<p>程序测试：</p>
<p>测试环境：</p>
<p><img src="/%E9%80%89%E5%8C%BA_052.png" alt="选区_052"></p>
<p>运行程序前：<code>sudo setcap cap_net_raw+eip /bin/ping</code>  保证文件有<code>eip</code> 权能</p>
<ul>
<li><p>sudo apt install libcap-dev</p>
</li>
<li><p>gcc cap.c -lcap -o cap</p>
</li>
<li><p>sudo .&#x2F;cap</p>
</li>
</ul>
<p>一开始可以<code>ping</code> :</p>
<p><img src="/%E9%80%89%E5%8C%BA_053.png" alt="选区_053"></p>
<p>暂时性删除权能后无法<code>ping</code> :</p>
<p><img src="/%E9%80%89%E5%8C%BA_054.png" alt="选区_054"></p>
<p>恢复后可以<code>ping</code>  :</p>
<p><img src="/%E9%80%89%E5%8C%BA_055.png" alt="选区_055"></p>
<p>永久删除后无法<code>ping</code> :</p>
<p><img src="/%E9%80%89%E5%8C%BA_056.png" alt="选区_056"></p>
<blockquote>
<p>参考资料：</p>
<p><a target="_blank" rel="noopener" href="https://www.hrwhisper.me/introduction-to-linux-capability/#comments">Linux setuid与权能介绍</a></p>
<p><a target="_blank" rel="noopener" href="https://www.wolfcstech.com/2017/07/10/linux-capabilities-overview/">Linux 权能综述</a></p>
</blockquote>

                
            </div>
            <hr/>

            

    <div class="reprint" id="reprint-statement">
        
            <div class="reprint__author">
                <span class="reprint-meta" style="font-weight: bold;">
                    <i class="fas fa-user">
                        文章作者:
                    </i>
                </span>
                <span class="reprint-info">
                    <a href="/about" rel="external nofollow noreferrer">Xu Shouyin</a>
                </span>
            </div>
            <div class="reprint__type">
                <span class="reprint-meta" style="font-weight: bold;">
                    <i class="fas fa-link">
                        文章链接:
                    </i>
                </span>
                <span class="reprint-info">
                    <a href="https://Xsyin.github.io/2018/05/01/Linux-%E6%9D%83%E8%83%BD%E6%9C%BA%E5%88%B6/">https://Xsyin.github.io/2018/05/01/Linux-%E6%9D%83%E8%83%BD%E6%9C%BA%E5%88%B6/</a>
                </span>
            </div>
            <div class="reprint__notice">
                <span class="reprint-meta" style="font-weight: bold;">
                    <i class="fas fa-copyright">
                        版权声明:
                    </i>
                </span>
                <span class="reprint-info">
                    本博客所有文章除特別声明外，均采用
                    <a href="https://creativecommons.org/licenses/by/4.0/deed.zh" rel="external nofollow noreferrer" target="_blank">CC BY 4.0</a>
                    许可协议。转载请注明来源
                    <a href="/about" target="_blank">Xu Shouyin</a>
                    !
                </span>
            </div>
        
    </div>

    <script async defer>
      document.addEventListener("copy", function (e) {
        let toastHTML = '<span>复制成功，请遵循本文的转载规则</span><button class="btn-flat toast-action" onclick="navToReprintStatement()" style="font-size: smaller">查看</a>';
        M.toast({html: toastHTML})
      });

      function navToReprintStatement() {
        $("html, body").animate({scrollTop: $("#reprint-statement").offset().top - 80}, 800);
      }
    </script>



            <div class="tag_share" style="display: block;">
                <div class="post-meta__tag-list" style="display: inline-block;">
                    
                        <div class="article-tag">
                            
                                <a href="/tags/Linux/">
                                    <span class="chip bg-color">Linux</span>
                                </a>
                            
                                <a href="/tags/capability/">
                                    <span class="chip bg-color">capability</span>
                                </a>
                            
                        </div>
                    
                </div>
                <div class="post_share" style="zoom: 80%; width: fit-content; display: inline-block; float: right; margin: -0.15rem 0;">
                    <link rel="stylesheet" type="text/css" href="/libs/share/css/share.min.css">
<div id="article-share">

    
    <div class="social-share" data-sites="twitter,facebook,google,qq,qzone,wechat,weibo,douban,linkedin" data-wechat-qrcode-helper="<p>微信扫一扫即可分享！</p>"></div>
    <script src="/libs/share/js/social-share.min.js"></script>
    

    

</div>

                </div>
            </div>
            
                <style>
    #reward {
        margin: 40px 0;
        text-align: center;
    }

    #reward .reward-link {
        font-size: 1.4rem;
        line-height: 38px;
    }

    #reward .btn-floating:hover {
        box-shadow: 0 6px 12px rgba(0, 0, 0, 0.2), 0 5px 15px rgba(0, 0, 0, 0.2);
    }

    #rewardModal {
        width: 320px;
        height: 350px;
    }

    #rewardModal .reward-title {
        margin: 15px auto;
        padding-bottom: 5px;
    }

    #rewardModal .modal-content {
        padding: 10px;
    }

    #rewardModal .close {
        position: absolute;
        right: 15px;
        top: 15px;
        color: rgba(0, 0, 0, 0.5);
        font-size: 1.3rem;
        line-height: 20px;
        cursor: pointer;
    }

    #rewardModal .close:hover {
        color: #ef5350;
        transform: scale(1.3);
        -moz-transform:scale(1.3);
        -webkit-transform:scale(1.3);
        -o-transform:scale(1.3);
    }

    #rewardModal .reward-tabs {
        margin: 0 auto;
        width: 210px;
    }

    .reward-tabs .tabs {
        height: 38px;
        margin: 10px auto;
        padding-left: 0;
    }

    .reward-content ul {
        padding-left: 0 !important;
    }

    .reward-tabs .tabs .tab {
        height: 38px;
        line-height: 38px;
    }

    .reward-tabs .tab a {
        color: #fff;
        background-color: #ccc;
    }

    .reward-tabs .tab a:hover {
        background-color: #ccc;
        color: #fff;
    }

    .reward-tabs .wechat-tab .active {
        color: #fff !important;
        background-color: #22AB38 !important;
    }

    .reward-tabs .alipay-tab .active {
        color: #fff !important;
        background-color: #019FE8 !important;
    }

    .reward-tabs .reward-img {
        width: 210px;
        height: 210px;
    }
</style>

<div id="reward">
    <a href="#rewardModal" class="reward-link modal-trigger btn-floating btn-medium waves-effect waves-light red">赏</a>

    <!-- Modal Structure -->
    <div id="rewardModal" class="modal">
        <div class="modal-content">
            <a class="close modal-close"><i class="fas fa-times"></i></a>
            <h4 class="reward-title">你的赏识是我前进的动力</h4>
            <div class="reward-content">
                <div class="reward-tabs">
                    <ul class="tabs row">
                        <li class="tab col s6 alipay-tab waves-effect waves-light"><a href="#alipay">支付宝</a></li>
                        <li class="tab col s6 wechat-tab waves-effect waves-light"><a href="#wechat">微 信</a></li>
                    </ul>
                    <div id="alipay">
                        <img src="/medias/reward/alipay.jpg" class="reward-img" alt="支付宝打赏二维码">
                    </div>
                    <div id="wechat">
                        <img src="/medias/reward/wechat.png" class="reward-img" alt="微信打赏二维码">
                    </div>
                </div>
            </div>
        </div>
    </div>
</div>

<script>
    $(function () {
        $('.tabs').tabs();
    });
</script>

            
        </div>
    </div>

    

    

    

    

    

    

    

    

<article id="prenext-posts" class="prev-next articles">
    <div class="row article-row">
        
        <div class="article col s12 m6" data-aos="fade-up">
            <div class="article-badge left-badge text-color">
                <i class="fas fa-chevron-left"></i>&nbsp;上一篇</div>
            <div class="card">
                <a href="/2018/05/01/%E5%9F%BA%E7%A1%80%E6%A0%88%E6%BA%A2%E5%87%BA/">
                    <div class="card-image">
                        
                        
                        <img src="/medias/featureimages/10.jpg" class="responsive-img" alt="基础栈溢出">
                        
                        <span class="card-title">基础栈溢出</span>
                    </div>
                </a>
                <div class="card-content article-content">
                    <div class="summary block-with-text">
                        
                            目的
理解掌握C 栈帧结构
Shellcode 构造
加深理解栈溢出攻击原理及防护措施

要求
在关闭安全机制下,在Linux系统平台上实现缓冲区溢出攻击
开启安全保护机制,运行一样的溢出攻击代码,比较实现现象

                        
                    </div>
                    <div class="publish-info">
                        <span class="publish-date">
                            <i class="far fa-clock fa-fw icon-date"></i>2018-05-01
                        </span>
                        <span class="publish-author">
                            
                            <i class="fas fa-bookmark fa-fw icon-category"></i>
                            
                            <a href="/categories/%E5%AE%89%E5%85%A8/" class="post-category">
                                    安全
                                </a>
                            
                            
                        </span>
                    </div>
                </div>
                
                <div class="card-action article-tags">
                    
                    <a href="/tags/Linux/">
                        <span class="chip bg-color">Linux</span>
                    </a>
                    
                    <a href="/tags/%E6%A0%88%E6%BA%A2%E5%87%BA/">
                        <span class="chip bg-color">栈溢出</span>
                    </a>
                    
                </div>
                
            </div>
        </div>
        
        
        <div class="article col s12 m6" data-aos="fade-up">
            <div class="article-badge right-badge text-color">
                下一篇&nbsp;<i class="fas fa-chevron-right"></i>
            </div>
            <div class="card">
                <a href="/2018/05/01/Linux%E6%9D%83%E8%83%BD%E4%B8%8EPAM%E6%9C%BA%E5%88%B6/">
                    <div class="card-image">
                        
                        
                        <img src="/medias/featureimages/8.jpg" class="responsive-img" alt="Linux权能与PAM机制">
                        
                        <span class="card-title">Linux权能与PAM机制</span>
                    </div>
                </a>
                <div class="card-content article-content">
                    <div class="summary block-with-text">
                        
                            
实验环境：uname -a
​      Linux ubuntu 4.4.0-121-generic #145-Ubuntu SMP Fri Apr 13 13:47:23 UTC 2018 x86_64 x86_64 x86_64 G
                        
                    </div>
                    <div class="publish-info">
                            <span class="publish-date">
                                <i class="far fa-clock fa-fw icon-date"></i>2018-05-01
                            </span>
                        <span class="publish-author">
                            
                            <i class="fas fa-bookmark fa-fw icon-category"></i>
                            
                            <a href="/categories/Linux/" class="post-category">
                                    Linux
                                </a>
                            
                            
                        </span>
                    </div>
                </div>
                
                <div class="card-action article-tags">
                    
                    <a href="/tags/Linux-capability/">
                        <span class="chip bg-color">Linux capability</span>
                    </a>
                    
                </div>
                
            </div>
        </div>
        
    </div>
</article>

</div>



<!-- 代码块功能依赖 -->
<script type="text/javascript" src="/libs/codeBlock/codeBlockFuction.js"></script>

<!-- 代码语言 -->

<script type="text/javascript" src="/libs/codeBlock/codeLang.js"></script>


<!-- 代码块复制 -->

<script type="text/javascript" src="/libs/codeBlock/codeCopy.js"></script>


<!-- 代码块收缩 -->

<script type="text/javascript" src="/libs/codeBlock/codeShrink.js"></script>


    </div>
    <div id="toc-aside" class="expanded col l3 hide-on-med-and-down">
        <div class="toc-widget card" style="background-color: white;">
            <div class="toc-title"><i class="far fa-list-alt"></i>&nbsp;&nbsp;目录</div>
            <div id="toc-content"></div>
        </div>
    </div>
</div>

<!-- TOC 悬浮按钮. -->

<div id="floating-toc-btn" class="hide-on-med-and-down">
    <a class="btn-floating btn-large bg-color">
        <i class="fas fa-list-ul"></i>
    </a>
</div>


<script src="/libs/tocbot/tocbot.min.js"></script>
<script>
    $(function () {
        tocbot.init({
            tocSelector: '#toc-content',
            contentSelector: '#articleContent',
            headingsOffset: -($(window).height() * 0.4 - 45),
            collapseDepth: Number('0'),
            headingSelector: 'h2, h3, h4'
        });

        // modify the toc link href to support Chinese.
        let i = 0;
        let tocHeading = 'toc-heading-';
        $('#toc-content a').each(function () {
            $(this).attr('href', '#' + tocHeading + (++i));
        });

        // modify the heading title id to support Chinese.
        i = 0;
        $('#articleContent').children('h2, h3, h4').each(function () {
            $(this).attr('id', tocHeading + (++i));
        });

        // Set scroll toc fixed.
        let tocHeight = parseInt($(window).height() * 0.4 - 64);
        let $tocWidget = $('.toc-widget');
        $(window).scroll(function () {
            let scroll = $(window).scrollTop();
            /* add post toc fixed. */
            if (scroll > tocHeight) {
                $tocWidget.addClass('toc-fixed');
            } else {
                $tocWidget.removeClass('toc-fixed');
            }
        });

        
        /* 修复文章卡片 div 的宽度. */
        let fixPostCardWidth = function (srcId, targetId) {
            let srcDiv = $('#' + srcId);
            if (srcDiv.length === 0) {
                return;
            }

            let w = srcDiv.width();
            if (w >= 450) {
                w = w + 21;
            } else if (w >= 350 && w < 450) {
                w = w + 18;
            } else if (w >= 300 && w < 350) {
                w = w + 16;
            } else {
                w = w + 14;
            }
            $('#' + targetId).width(w);
        };

        // 切换TOC目录展开收缩的相关操作.
        const expandedClass = 'expanded';
        let $tocAside = $('#toc-aside');
        let $mainContent = $('#main-content');
        $('#floating-toc-btn .btn-floating').click(function () {
            if ($tocAside.hasClass(expandedClass)) {
                $tocAside.removeClass(expandedClass).hide();
                $mainContent.removeClass('l9');
            } else {
                $tocAside.addClass(expandedClass).show();
                $mainContent.addClass('l9');
            }
            fixPostCardWidth('artDetail', 'prenext-posts');
        });
        
    });
</script>

    

</main>




    <footer class="page-footer bg-color">
    
        <link rel="stylesheet" href="/libs/aplayer/APlayer.min.css">
<style>
    .aplayer .aplayer-lrc p {
        
        display: none;
        
        font-size: 12px;
        font-weight: 700;
        line-height: 16px !important;
    }

    .aplayer .aplayer-lrc p.aplayer-lrc-current {
        
        display: none;
        
        font-size: 15px;
        color: #42b983;
    }

    
    .aplayer.aplayer-fixed.aplayer-narrow .aplayer-body {
        left: -66px !important;
    }

    .aplayer.aplayer-fixed.aplayer-narrow .aplayer-body:hover {
        left: 0px !important;
    }

    
</style>
<div class="">
    
    <div class="row">
        <meting-js class="col l8 offset-l2 m10 offset-m1 s12"
                   server="netease"
                   type="playlist"
                   id="503838841"
                   fixed='true'
                   autoplay='false'
                   theme='#42b983'
                   loop='all'
                   order='random'
                   preload='auto'
                   volume='0.7'
                   list-folded='true'
        >
        </meting-js>
    </div>
</div>

<script src="/libs/aplayer/APlayer.min.js"></script>
<script src="https://cdn.jsdelivr.net/npm/meting@2/dist/Meting.min.js"></script>

    
    <div class="container row center-align" style="margin-bottom: 0px !important;">
        <div class="col s12 m8 l8 copy-right">
            Copyright&nbsp;&copy;
            
                <span id="year">2019-2024</span>
            
            <span id="year">2019</span>
            <a href="/about" target="_blank">Xu Shouyin</a>
            |&nbsp;Powered by&nbsp;<a href="https://hexo.io/" target="_blank">Hexo</a>
            |&nbsp;Theme&nbsp;<a href="https://github.com/blinkfox/hexo-theme-matery" target="_blank">Matery</a>
            <br>
            
            
            
            
            
            
            <span id="busuanzi_container_site_pv">
                |&nbsp;<i class="far fa-eye"></i>&nbsp;总访问量:&nbsp;<span id="busuanzi_value_site_pv"
                    class="white-color"></span>&nbsp;次
            </span>
            
            
            <span id="busuanzi_container_site_uv">
                |&nbsp;<i class="fas fa-users"></i>&nbsp;总访问人数:&nbsp;<span id="busuanzi_value_site_uv"
                    class="white-color"></span>&nbsp;人
            </span>
            
            <br>
            
            <br>
            
        </div>
        <div class="col s12 m4 l4 social-link social-statis">
    <a href="https://github.com/blinkfox" class="tooltipped" target="_blank" data-tooltip="访问我的GitHub" data-position="top" data-delay="50">
        <i class="fab fa-github"></i>
    </a>



    <a href="mailto:1181062873@qq.com" class="tooltipped" target="_blank" data-tooltip="邮件联系我" data-position="top" data-delay="50">
        <i class="fas fa-envelope-open"></i>
    </a>







    <a href="tencent://AddContact/?fromId=50&fromSubId=1&subcmd=all&uin=1181062873" class="tooltipped" target="_blank" data-tooltip="QQ联系我: 1181062873" data-position="top" data-delay="50">
        <i class="fab fa-qq"></i>
    </a>







    <a href="/atom.xml" class="tooltipped" target="_blank" data-tooltip="RSS 订阅" data-position="top" data-delay="50">
        <i class="fas fa-rss"></i>
    </a>

</div>
    </div>
</footer>

<div class="progress-bar"></div>


    <!-- 搜索遮罩框 -->
<div id="searchModal" class="modal">
    <div class="modal-content">
        <div class="search-header">
            <span class="title"><i class="fas fa-search"></i>&nbsp;&nbsp;搜索</span>
            <input type="search" id="searchInput" name="s" placeholder="请输入搜索的关键字"
                   class="search-input">
        </div>
        <div id="searchResult"></div>
    </div>
</div>

<script type="text/javascript">
$(function () {
    var searchFunc = function (path, search_id, content_id) {
        'use strict';
        $.ajax({
            url: path,
            dataType: "xml",
            success: function (xmlResponse) {
                // get the contents from search data
                var datas = $("entry", xmlResponse).map(function () {
                    return {
                        title: $("title", this).text(),
                        content: $("content", this).text(),
                        url: $("url", this).text()
                    };
                }).get();
                var $input = document.getElementById(search_id);
                var $resultContent = document.getElementById(content_id);
                $input.addEventListener('input', function () {
                    var str = '<ul class=\"search-result-list\">';
                    var keywords = this.value.trim().toLowerCase().split(/[\s\-]+/);
                    $resultContent.innerHTML = "";
                    if (this.value.trim().length <= 0) {
                        return;
                    }
                    // perform local searching
                    datas.forEach(function (data) {
                        var isMatch = true;
                        var data_title = data.title.trim().toLowerCase();
                        var data_content = data.content.trim().replace(/<[^>]+>/g, "").toLowerCase();
                        var data_url = data.url;
                        data_url = data_url.indexOf('/') === 0 ? data.url : '/' + data_url;
                        var index_title = -1;
                        var index_content = -1;
                        var first_occur = -1;
                        // only match artiles with not empty titles and contents
                        if (data_title !== '' && data_content !== '') {
                            keywords.forEach(function (keyword, i) {
                                index_title = data_title.indexOf(keyword);
                                index_content = data_content.indexOf(keyword);
                                if (index_title < 0 && index_content < 0) {
                                    isMatch = false;
                                } else {
                                    if (index_content < 0) {
                                        index_content = 0;
                                    }
                                    if (i === 0) {
                                        first_occur = index_content;
                                    }
                                }
                            });
                        }
                        // show search results
                        if (isMatch) {
                            str += "<li><a href='" + data_url + "' class='search-result-title'>" + data_title + "</a>";
                            var content = data.content.trim().replace(/<[^>]+>/g, "");
                            if (first_occur >= 0) {
                                // cut out 100 characters
                                var start = first_occur - 20;
                                var end = first_occur + 80;
                                if (start < 0) {
                                    start = 0;
                                }
                                if (start === 0) {
                                    end = 100;
                                }
                                if (end > content.length) {
                                    end = content.length;
                                }
                                var match_content = content.substr(start, end);
                                // highlight all keywords
                                keywords.forEach(function (keyword) {
                                    var regS = new RegExp(keyword, "gi");
                                    match_content = match_content.replace(regS, "<em class=\"search-keyword\">" + keyword + "</em>");
                                });

                                str += "<p class=\"search-result\">" + match_content + "...</p>"
                            }
                            str += "</li>";
                        }
                    });
                    str += "</ul>";
                    $resultContent.innerHTML = str;
                });
            }
        });
    };

    searchFunc('/search.xml', 'searchInput', 'searchResult');
});
</script>

    <!-- 回到顶部按钮 -->
<div id="backTop" class="top-scroll">
    <a class="btn-floating btn-large waves-effect waves-light" href="#!">
        <i class="fas fa-arrow-up"></i>
    </a>
</div>


    <script src="/libs/materialize/materialize.min.js"></script>
    <script src="/libs/masonry/masonry.pkgd.min.js"></script>
    <script src="/libs/aos/aos.js"></script>
    <script src="/libs/scrollprogress/scrollProgress.min.js"></script>
    <script src="/libs/lightGallery/js/lightgallery-all.min.js"></script>
    <script src="/js/matery.js"></script>

    <!-- Baidu Analytics -->

    <!-- Baidu Push -->

<script>
    (function () {
        var bp = document.createElement('script');
        var curProtocol = window.location.protocol.split(':')[0];
        if (curProtocol === 'https') {
            bp.src = 'https://zz.bdstatic.com/linksubmit/push.js';
        } else {
            bp.src = 'http://push.zhanzhang.baidu.com/push.js';
        }
        var s = document.getElementsByTagName("script")[0];
        s.parentNode.insertBefore(bp, s);
    })();
</script>

    
    <script src="/libs/others/clicklove.js" async="async"></script>
    
    
    <script async src="/libs/others/busuanzi.pure.mini.js"></script>
    

    

    

	
    

    

    

    
    <script src="/libs/instantpage/instantpage.js" type="module"></script>
    

</body>

</html>
